CVE-2024-5333

The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

1.09% chance of exploitation in the next 30 days, 63th percentile

Nuclei

medium · CWE-639

Published

2024-12-16

Updated

2025-08-27

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/764b5a23-8b51-4882-b899-beb54f684984/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5333.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2024-53326
• CVE-2024-53333
• CVE-2024-53307
• CVE-2024-53334
• CVE-2024-53274
• CVE-2024-53335